Setting the file. One moment. Running Work Transitions
56.10
Example Agent Review
(opens in a new tab)
scripts/security-scan.sh
Shell·255 lines·9 KB
13else
14 # Default: Assume script is in .claude/skills/reviewing-claude-config/scripts/
15 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
16 CLAUDE_DIR="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
17fi
18
19# Validate directory exists
20if [ ! -d "${CLAUDE_DIR}" ]; then
21 echo "Error: Directory '${CLAUDE_DIR}' does not exist"
22 exit 1
23fi
24
25echo "=== Claude Configuration Security Scan ==="
26echo "Scanning: ${CLAUDE_DIR}"
27echo ""
28
29ISSUES_FOUND=0
30
31# ============================================================================
32# Check 1: Committed settings.local.json
33# ============================================================================
34echo "[1/4] Checking for committed settings.local.json..."
35
36if git ls-files 2>/dev/null | grep -q "settings.local.json"; then
37 echo " ❌ CRITICAL: settings.local.json is committed to git"
38 echo " Files found:"
39 git ls-files | grep "settings.local.json" | sed 's/^/ - /'
40 echo ""
41 echo " Remediation:"
42 echo " git rm --cached .claude/settings.local.json"
43 echo " echo '.claude/settings.local.json' >> .gitignore"
44 echo ""
45 ISSUES_FOUND=$((ISSUES_FOUND + 1))
46else
47 echo " ✅ OK: settings.local.json not in git"
48fi
49echo ""
50
51# ============================================================================
52# Check 2: Hardcoded secrets
53# ============================================================================
54echo "[2/4] Scanning for hardcoded secrets..."
55
56SECRET_FOUND=0
57TEMP_FILE=$(mktemp)
58
59# OpenAI API keys (sk-...)
60if grep -rE "sk-[a-zA-Z0-9]{32,}" "${CLAUDE_DIR}" 2>/dev/null | grep -v "security-scan.sh" | grep -v "security-patterns.md" | grep -v "examples/" > "${TEMP_FILE}"; then
61 echo " ❌ CRITICAL: OpenAI API key pattern detected"
62 echo " Locations:"
63 cat "${TEMP_FILE}" | sed 's/^/ /'
64 echo ""
65 SECRET_FOUND=1
66fi
67
68# GitHub tokens (ghp_..., gho_...)
69if grep -rE "gh[po]_[a-zA-Z0-9]{36}" "${CLAUDE_DIR}" 2>/dev/null | grep -v "security-scan.sh" | grep -v "security-patterns.md" | grep -v "examples/" > "${TEMP_FILE}"; then
70 echo " ❌ CRITICAL: GitHub token pattern detected"
71 echo " Locations:"
72 cat "${TEMP_FILE}" | sed 's/^/ /'
73 echo ""
74 SECRET_FOUND=1
75fi
76
77# Generic credentials (apiKey: "...", password: "...", etc.)
78# More sophisticated: Look for quotes around values, exclude documentation examples
79if grep -rE '(apiKey|api_key|password|passwd|token|secret)["'\'']?\s*[:=]\s*["'\''][^"'\'']{8,}' "${CLAUDE_DIR}" 2>/dev/null | \
80 grep -v "security-scan.sh" | \
81 grep -v "security-patterns.md" | \
82 grep -v "examples/" | \
83 grep -v "example" | \
84 grep -v "EXAMPLE" | \
85 grep -v "your-key-here" | \
86 grep -v "xxx" > "${TEMP_FILE}"; then
87 echo " ❌ CRITICAL: Potential hardcoded credential detected"
88 echo " Locations:"
89 cat "${TEMP_FILE}" | sed 's/^/ /'
90 echo ""
91 echo " Note: Review these manually - may be false positives in documentation"
92 echo ""
93 SECRET_FOUND=1
94fi
95
96rm -f "${TEMP_FILE}"
97
98if [ $SECRET_FOUND -eq 0 ]; then
99 echo " ✅ OK: No hardcoded secrets detected"
100else
101 echo " Remediation:"
102 echo " - Remove hardcoded credentials from files"
103 echo " - Use environment variables instead"
104 echo " - Document required env vars in README"
105 echo ""
106 ISSUES_FOUND=$((ISSUES_FOUND + 1))
107fi
108echo ""
109
110# ============================================================================
111# Check 3: Broad permissions
112# ============================================================================
113echo "[3/4] Validating permission scoping..."
114
115if [ -f "${CLAUDE_DIR}/settings.json" ]; then
116 PERM_ISSUES=0
117
118 # Check for wildcard permissions
119 if grep -q 'Read://\*' "${CLAUDE_DIR}/settings.json" 2>/dev/null; then
120 echo " ❌ CRITICAL: Overly broad Read permissions (Read://*)"
121 echo " File: ${CLAUDE_DIR}/settings.json"
122 echo " Issue: Grants read access to entire filesystem"
123 echo ""
124 PERM_ISSUES=1
125 fi
126
127 if grep -q 'Write://\*' "${CLAUDE_DIR}/settings.json" 2>/dev/null; then
128 echo " ❌ CRITICAL: Overly broad Write permissions (Write://*)"
129 echo " File: ${CLAUDE_DIR}/settings.json"
130 echo " Issue: Grants write access to entire filesystem"
131 echo ""
132 PERM_ISSUES=1
133 fi
134
135 if grep -q '"Bash:\*"' "${CLAUDE_DIR}/settings.json" 2>/dev/null; then
136 echo " ❌ CRITICAL: Auto-approve all Bash commands (Bash:*)"
137 echo " File: ${CLAUDE_DIR}/settings.json"
138 echo " Issue: Allows any bash command without approval"
139 echo ""
140 PERM_ISSUES=1
141 fi
142
143 # Check for sensitive paths
144 SENSITIVE_PATHS=(".ssh" ".aws" ".gnupg" "/etc" "id_rsa" "credentials")
145 for path in "${SENSITIVE_PATHS[@]}"; do
146 if grep -q "$path" "${CLAUDE_DIR}/settings.json" 2>/dev/null; then
147 echo " ⚠️ WARNING: Permissions reference sensitive path: $path"
148 echo " File: ${CLAUDE_DIR}/settings.json"
149 echo " Review manually to ensure appropriate scoping"
150 echo ""
151 PERM_ISSUES=1
152 fi
153 done
154
155 if [ $PERM_ISSUES -eq 0 ]; then
156 echo " ✅ OK: Permissions appropriately scoped"
157 else
158 echo " Remediation:"
159 echo " - Scope Read/Write permissions to project directory only"
160 echo " - Specify individual Bash commands, not wildcards"
161 echo " - Remove access to sensitive directories (~/.ssh, ~/.aws, /etc)"
162 echo ""
163 ISSUES_FOUND=$((ISSUES_FOUND + 1))
164 fi
165else
166 echo " ℹ️ No settings.json found (OK)"
167fi
168echo ""
169
170# ============================================================================
171# Check 4: Dangerous commands
172# ============================================================================
173echo "[4/4] Checking for dangerous command auto-approvals..."
174
175if [ -f "${CLAUDE_DIR}/settings.json" ]; then
176 DANGEROUS_FOUND=0
177
178 # Define dangerous command patterns
179 DANGEROUS_PATTERNS=(
180 "rm -rf"
181 "rm -fr"
182 "git push --force"
183 "git push -f"
184 "chmod 777"
185 "chmod 666"
186 "curl.*| sh"
187 "curl.*| bash"
188 "wget.*| sh"
189 "wget.*| bash"
190 "dd if="
191 "mkfs"
192 "> /dev/sd"
193 )
194
195 for pattern in "${DANGEROUS_PATTERNS[@]}"; do
196 if grep -qE "\".*${pattern}.*\"" "${CLAUDE_DIR}/settings.json" 2>/dev/null; then
197 echo " ❌ CRITICAL: Dangerous command auto-approved: ${pattern}"
198 echo " File: ${CLAUDE_DIR}/settings.json"
199 DANGEROUS_FOUND=1
200 fi
201 done
202
203 if [ $DANGEROUS_FOUND -eq 0 ]; then
204 echo " ✅ OK: No dangerous command auto-approvals"
205 else
206 echo ""
207 echo " Dangerous commands can cause:"
208 echo " - Data loss (rm -rf, dd, mkfs)"
209 echo " - Security vulnerabilities (chmod 777, curl | sh)"
210 echo " - Repository damage (git push --force)"
211 echo ""
212 echo " Remediation:"
213 echo " - Remove dangerous command auto-approvals"
214 echo " - Scope to safe read-only commands (git status, ls, grep)"
215 echo " - Require manual approval for destructive operations"
216 echo ""
217 ISSUES_FOUND=$((ISSUES_FOUND + 1))
218 fi
219else
220 echo " ℹ️ No settings.json found (OK)"
221fi
222echo ""
223
224# ============================================================================
225# Summary
226# ============================================================================
227echo "=== Scan Complete ==="
228echo ""
229
230if [ $ISSUES_FOUND -eq 0 ]; then
231 echo "✅ All security checks passed"
232 echo ""
233 echo "Claude configuration appears secure:"
234 echo " - No committed local settings"
235 echo " - No hardcoded secrets detected"
236 echo " - Permissions appropriately scoped"
237 echo " - No dangerous command auto-approvals"
238 echo ""
239 exit 0
240else
241 echo "❌ Found ${ISSUES_FOUND} critical security issue(s)"
242 echo ""
243 echo "Review the issues above and remediate before approval."
244 echo ""
245 echo "Common fixes:"
246 echo " - Remove settings.local.json from git: git rm --cached .claude/settings.local.json"
247 echo " - Replace hardcoded secrets with environment variables"
248 echo " - Scope permissions to project directory only"
249 echo " - Remove dangerous command auto-approvals"
250 echo ""
251 echo "For detailed remediation guidance, see:"
252 echo " ${CLAUDE_DIR}/skills/reviewing-claude-config/reference/security-patterns.md"
253 echo ""
254 exit 1
255fi